6 Posts
1
5397
Dell Command Update and FIPS mode: Error 1920
Installing the latest Dell Command Update Version 3.1.2 on a system with FIPS mode activated results in Error 1920. Service Dell Client Management Service (DellClientManagementService) failed to start.
Is there a different version of this tool that can be used by FIPS customers? If not, we need an update that uses FIPS validated cryptographic algorithms.
The Event Viewer clearly shows that it's because an insecure cryptographic provider, MD5, is being invoked by the service.
Service cannot be started. System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.InvalidOperationException: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.
at System.Security.Cryptography.MD5CryptoServiceProvider..ctor()
--- End of inner exception stack trace ---
at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor)
at System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
at System.Security.Cryptography.CryptoConfig.CreateFromName(String name, Object[] args)
at System.Security.Cryptography.MD5.Create()
at Dell.Asimov.ServiceShell.Core.Channels.ValidatedNamedPipe.ValidatedNamedPipeChannelManager.GeneratePipeName(Uri listenUri)
at Dell.Asimov.ServiceShell.Core.Channels.ValidatedNamedPipe.ValidatedNamedPipeChannelListener..ctor(ValidatedNamedPipeTransportBindingE...
A9G-Data-Droid
2 Posts
0
January 26th, 2022 10:00
I apologize. The latest version of DCU works with FIPS systems. I didn't know that because we uninstalled it everywhere a long time ago. We had been using the powershell method, which stopped working. Now I can go back to using the DCU app.
dirty_white_hat
6 Posts
1
April 30th, 2020 09:00
Note to DELL developers: You can replace all calls to MD5 with SHA1CryptoServiceProvider and it will work
https://docs.microsoft.com/en-us/dotnet/api/system.security.cryptography.sha1cryptoserviceprovider?redirectedfrom=MSDN&view=netcore-3.1
Mgamerz
10 Posts
2
May 27th, 2020 13:00
Bump to this topic. We are having to turn FIPS mode on as part of a directive for the US federal government. This is going to progressively become more and more of an issue as more systems begin following this government wide directive to have FIPS on. In my office where I am early-adopting these settings, DCU no longer even installs (the service fails to start), let alone works.
Losing a tool like this is easily one of the biggest factors that would make me reconsider my suboffice stay with dell. They have nice tools to handle the management side of their hardware/software. If that stops working it's just another piece of hardware that I now have to manually maintain and update.
dirty_white_hat
6 Posts
0
May 27th, 2020 14:00
Poke the bear. The squeaky wheel and whatnot.
Mgamerz
10 Posts
2
May 27th, 2020 14:00
I've tried to open tickets with Dell about Dell Command Update. It never goes anywhere, it's pretty much pointless. I have never once had any support or feedback from Dell when I have reported issues on it. If it works, great, but if it doesn't you're SOL.
One of the IT groups says they contacted Dell and did get someone to respond (they didn't say who) but that it would take a complete re-engineering of the application to work, so Dell wasn't going to. I mean, if I have to manually update all of my drivers now, I could just re-engineer my workforce onto someone like HP instead.
dirty_white_hat
6 Posts
0
May 27th, 2020 14:00
Thanks @Mgamerz, I have been going back and forth with Dell support on this topic. The last message I got from support was "we got an update from the L3 team to say this is working as designed. Let us know if you have any further queries."
I told them that answer was unacceptable. This doesn't need to go to L3 support, it needs to go to the software development team. I'm not sure how to get my ticket to that team. I recommend you open a ticket too. The more customers complain, the more likely they are to listen.
Spames
7 Posts
1
June 25th, 2020 10:00
I gave up and wrote a powershell that uses dcu-cli.exe and writes the xml catalog to a file. Then parse that file and perform the downloads and installs with powershell. @dirty_white_hat @Mgamerz
dirty_white_hat
6 Posts
1
June 25th, 2020 12:00
@Spamesare you able to open source your code on Github? If you want to share but don't have a github account I could make a site for this code to live on. Then we can all work on it together.
Spames
7 Posts
0
June 25th, 2020 16:00
Shouldn’t be a problem to do that, but I haven’t tried before. I’ll post a link here tomorrow. @dirty_white_hat
Spames
7 Posts
2
June 26th, 2020 03:00
@dirty_white_hat @Mgamerz
Hope this helps someone, and sorry for my uncommented code... I like using it with psexec and Taskpad View in ADUC to just click a computer and hit "Do Driver Updates". Done!
https://github.com/julrich-usgs/nofips-dell-drivers
A9G-Data-Droid
2 Posts
0
January 5th, 2022 10:00
This appears to have stopped working recently. Dell must have changed something on their end. We still can't use Dell Command Update on FIPS systems. That powershell workaround was the only thing we had.
DELL-Jesse L
Moderator
Moderator
•
16.7K Posts
0
January 26th, 2022 09:00
A9G-Data-Droid,
Did you send us the error log in a private message as requested by the previous agent? Once you send it we will share it with the product team for review and get back to you.